Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
165s -
max time network
177s -
platform
windows10-2004_x64 -
resource
win10v2004-20231215-en -
resource tags
arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system -
submitted
11/01/2024, 05:49
Static task
static1
Behavioral task
behavioral1
Sample
2024-01-10_4a380fbc8f12cffc01f946e7b1c07223_goldeneye.exe
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
2024-01-10_4a380fbc8f12cffc01f946e7b1c07223_goldeneye.exe
Resource
win10v2004-20231215-en
General
-
Target
2024-01-10_4a380fbc8f12cffc01f946e7b1c07223_goldeneye.exe
-
Size
408KB
-
MD5
4a380fbc8f12cffc01f946e7b1c07223
-
SHA1
bed45e2ddda481186767f7b5dd8213f0dd54c328
-
SHA256
58019f8d6b9fdc18d526a39f1b0b1b78c792d1146f7d67f7d14bb187c98da4c7
-
SHA512
291d902321aac267c9cb50b05d63dbcbaf9df0f49a188a9a2379a230c7609db81a168553d99cdcfc0ec6ccd4f45aff0ffe4f8cc1b55d1f1c5cef2a1b2bb0835f
-
SSDEEP
3072:CEGh0oOl3OiNOe2MUVg3bHrH/HqOYGte+rcC4F0fJGRIS8Rfd7eQEcGcrTutTBf3:CEGEldOe2MUVg3vTeKcAEciTBqr3jy
Malware Config
Signatures
-
Modifies Installed Components in the registry 2 TTPs 24 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{9944E714-E79B-4387-AF20-3C8F96C3F581}\stubpath = "C:\\Windows\\{9944E714-E79B-4387-AF20-3C8F96C3F581}.exe" {60983C17-CF91-4760-ADD7-04B5DC02C499}.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{E42F8875-22A6-4777-9D0B-3F85FF767880} {9944E714-E79B-4387-AF20-3C8F96C3F581}.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{E42F8875-22A6-4777-9D0B-3F85FF767880}\stubpath = "C:\\Windows\\{E42F8875-22A6-4777-9D0B-3F85FF767880}.exe" {9944E714-E79B-4387-AF20-3C8F96C3F581}.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{872391C0-498C-4c7d-A10F-01D9D9A2684B} 2024-01-10_4a380fbc8f12cffc01f946e7b1c07223_goldeneye.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{1A829D01-BEA0-4238-BF08-0458346EE3F1} {872391C0-498C-4c7d-A10F-01D9D9A2684B}.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{60983C17-CF91-4760-ADD7-04B5DC02C499} {A03A545E-69A5-49d5-A06F-AED6EB1C271C}.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{60983C17-CF91-4760-ADD7-04B5DC02C499}\stubpath = "C:\\Windows\\{60983C17-CF91-4760-ADD7-04B5DC02C499}.exe" {A03A545E-69A5-49d5-A06F-AED6EB1C271C}.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{085DFF69-D016-40df-AC85-43979336F1B2}\stubpath = "C:\\Windows\\{085DFF69-D016-40df-AC85-43979336F1B2}.exe" {3898AC27-C901-4261-9818-11C4B5982E0B}.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{AD042B2E-8573-4c31-9E90-27EDA5370DCB} {085DFF69-D016-40df-AC85-43979336F1B2}.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{9ECFE33B-56EC-4a45-9D5E-2D3DD8D21A15} {32FE0323-7AF7-42b8-9EE1-A63D56B72FAD}.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{9ECFE33B-56EC-4a45-9D5E-2D3DD8D21A15}\stubpath = "C:\\Windows\\{9ECFE33B-56EC-4a45-9D5E-2D3DD8D21A15}.exe" {32FE0323-7AF7-42b8-9EE1-A63D56B72FAD}.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{D4BCE1D1-689A-4711-8BC1-34FBAB19AD77} {9ECFE33B-56EC-4a45-9D5E-2D3DD8D21A15}.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{A03A545E-69A5-49d5-A06F-AED6EB1C271C}\stubpath = "C:\\Windows\\{A03A545E-69A5-49d5-A06F-AED6EB1C271C}.exe" {AD042B2E-8573-4c31-9E90-27EDA5370DCB}.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{872391C0-498C-4c7d-A10F-01D9D9A2684B}\stubpath = "C:\\Windows\\{872391C0-498C-4c7d-A10F-01D9D9A2684B}.exe" 2024-01-10_4a380fbc8f12cffc01f946e7b1c07223_goldeneye.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{1A829D01-BEA0-4238-BF08-0458346EE3F1}\stubpath = "C:\\Windows\\{1A829D01-BEA0-4238-BF08-0458346EE3F1}.exe" {872391C0-498C-4c7d-A10F-01D9D9A2684B}.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{32FE0323-7AF7-42b8-9EE1-A63D56B72FAD} {1A829D01-BEA0-4238-BF08-0458346EE3F1}.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{32FE0323-7AF7-42b8-9EE1-A63D56B72FAD}\stubpath = "C:\\Windows\\{32FE0323-7AF7-42b8-9EE1-A63D56B72FAD}.exe" {1A829D01-BEA0-4238-BF08-0458346EE3F1}.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{AD042B2E-8573-4c31-9E90-27EDA5370DCB}\stubpath = "C:\\Windows\\{AD042B2E-8573-4c31-9E90-27EDA5370DCB}.exe" {085DFF69-D016-40df-AC85-43979336F1B2}.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{A03A545E-69A5-49d5-A06F-AED6EB1C271C} {AD042B2E-8573-4c31-9E90-27EDA5370DCB}.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{9944E714-E79B-4387-AF20-3C8F96C3F581} {60983C17-CF91-4760-ADD7-04B5DC02C499}.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{D4BCE1D1-689A-4711-8BC1-34FBAB19AD77}\stubpath = "C:\\Windows\\{D4BCE1D1-689A-4711-8BC1-34FBAB19AD77}.exe" {9ECFE33B-56EC-4a45-9D5E-2D3DD8D21A15}.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{3898AC27-C901-4261-9818-11C4B5982E0B} {D4BCE1D1-689A-4711-8BC1-34FBAB19AD77}.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{3898AC27-C901-4261-9818-11C4B5982E0B}\stubpath = "C:\\Windows\\{3898AC27-C901-4261-9818-11C4B5982E0B}.exe" {D4BCE1D1-689A-4711-8BC1-34FBAB19AD77}.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{085DFF69-D016-40df-AC85-43979336F1B2} {3898AC27-C901-4261-9818-11C4B5982E0B}.exe -
Executes dropped EXE 12 IoCs
pid Process 8 {872391C0-498C-4c7d-A10F-01D9D9A2684B}.exe 3376 {1A829D01-BEA0-4238-BF08-0458346EE3F1}.exe 3080 {32FE0323-7AF7-42b8-9EE1-A63D56B72FAD}.exe 316 {9ECFE33B-56EC-4a45-9D5E-2D3DD8D21A15}.exe 4584 {D4BCE1D1-689A-4711-8BC1-34FBAB19AD77}.exe 2028 {3898AC27-C901-4261-9818-11C4B5982E0B}.exe 3080 {085DFF69-D016-40df-AC85-43979336F1B2}.exe 1960 {AD042B2E-8573-4c31-9E90-27EDA5370DCB}.exe 3400 {A03A545E-69A5-49d5-A06F-AED6EB1C271C}.exe 492 {60983C17-CF91-4760-ADD7-04B5DC02C499}.exe 2304 {9944E714-E79B-4387-AF20-3C8F96C3F581}.exe 1204 {E42F8875-22A6-4777-9D0B-3F85FF767880}.exe -
Drops file in Windows directory 12 IoCs
description ioc Process File created C:\Windows\{32FE0323-7AF7-42b8-9EE1-A63D56B72FAD}.exe {1A829D01-BEA0-4238-BF08-0458346EE3F1}.exe File created C:\Windows\{D4BCE1D1-689A-4711-8BC1-34FBAB19AD77}.exe {9ECFE33B-56EC-4a45-9D5E-2D3DD8D21A15}.exe File created C:\Windows\{085DFF69-D016-40df-AC85-43979336F1B2}.exe {3898AC27-C901-4261-9818-11C4B5982E0B}.exe File created C:\Windows\{60983C17-CF91-4760-ADD7-04B5DC02C499}.exe {A03A545E-69A5-49d5-A06F-AED6EB1C271C}.exe File created C:\Windows\{9944E714-E79B-4387-AF20-3C8F96C3F581}.exe {60983C17-CF91-4760-ADD7-04B5DC02C499}.exe File created C:\Windows\{E42F8875-22A6-4777-9D0B-3F85FF767880}.exe {9944E714-E79B-4387-AF20-3C8F96C3F581}.exe File created C:\Windows\{1A829D01-BEA0-4238-BF08-0458346EE3F1}.exe {872391C0-498C-4c7d-A10F-01D9D9A2684B}.exe File created C:\Windows\{9ECFE33B-56EC-4a45-9D5E-2D3DD8D21A15}.exe {32FE0323-7AF7-42b8-9EE1-A63D56B72FAD}.exe File created C:\Windows\{3898AC27-C901-4261-9818-11C4B5982E0B}.exe {D4BCE1D1-689A-4711-8BC1-34FBAB19AD77}.exe File created C:\Windows\{AD042B2E-8573-4c31-9E90-27EDA5370DCB}.exe {085DFF69-D016-40df-AC85-43979336F1B2}.exe File created C:\Windows\{A03A545E-69A5-49d5-A06F-AED6EB1C271C}.exe {AD042B2E-8573-4c31-9E90-27EDA5370DCB}.exe File created C:\Windows\{872391C0-498C-4c7d-A10F-01D9D9A2684B}.exe 2024-01-10_4a380fbc8f12cffc01f946e7b1c07223_goldeneye.exe -
Suspicious use of AdjustPrivilegeToken 12 IoCs
description pid Process Token: SeIncBasePriorityPrivilege 1088 2024-01-10_4a380fbc8f12cffc01f946e7b1c07223_goldeneye.exe Token: SeIncBasePriorityPrivilege 8 {872391C0-498C-4c7d-A10F-01D9D9A2684B}.exe Token: SeIncBasePriorityPrivilege 3376 {1A829D01-BEA0-4238-BF08-0458346EE3F1}.exe Token: SeIncBasePriorityPrivilege 3080 {32FE0323-7AF7-42b8-9EE1-A63D56B72FAD}.exe Token: SeIncBasePriorityPrivilege 316 {9ECFE33B-56EC-4a45-9D5E-2D3DD8D21A15}.exe Token: SeIncBasePriorityPrivilege 4584 {D4BCE1D1-689A-4711-8BC1-34FBAB19AD77}.exe Token: SeIncBasePriorityPrivilege 2028 {3898AC27-C901-4261-9818-11C4B5982E0B}.exe Token: SeIncBasePriorityPrivilege 3080 {085DFF69-D016-40df-AC85-43979336F1B2}.exe Token: SeIncBasePriorityPrivilege 1960 {AD042B2E-8573-4c31-9E90-27EDA5370DCB}.exe Token: SeIncBasePriorityPrivilege 3400 {A03A545E-69A5-49d5-A06F-AED6EB1C271C}.exe Token: SeIncBasePriorityPrivilege 492 {60983C17-CF91-4760-ADD7-04B5DC02C499}.exe Token: SeIncBasePriorityPrivilege 2304 {9944E714-E79B-4387-AF20-3C8F96C3F581}.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1088 wrote to memory of 8 1088 2024-01-10_4a380fbc8f12cffc01f946e7b1c07223_goldeneye.exe 92 PID 1088 wrote to memory of 8 1088 2024-01-10_4a380fbc8f12cffc01f946e7b1c07223_goldeneye.exe 92 PID 1088 wrote to memory of 8 1088 2024-01-10_4a380fbc8f12cffc01f946e7b1c07223_goldeneye.exe 92 PID 1088 wrote to memory of 4972 1088 2024-01-10_4a380fbc8f12cffc01f946e7b1c07223_goldeneye.exe 93 PID 1088 wrote to memory of 4972 1088 2024-01-10_4a380fbc8f12cffc01f946e7b1c07223_goldeneye.exe 93 PID 1088 wrote to memory of 4972 1088 2024-01-10_4a380fbc8f12cffc01f946e7b1c07223_goldeneye.exe 93 PID 8 wrote to memory of 3376 8 {872391C0-498C-4c7d-A10F-01D9D9A2684B}.exe 99 PID 8 wrote to memory of 3376 8 {872391C0-498C-4c7d-A10F-01D9D9A2684B}.exe 99 PID 8 wrote to memory of 3376 8 {872391C0-498C-4c7d-A10F-01D9D9A2684B}.exe 99 PID 8 wrote to memory of 924 8 {872391C0-498C-4c7d-A10F-01D9D9A2684B}.exe 100 PID 8 wrote to memory of 924 8 {872391C0-498C-4c7d-A10F-01D9D9A2684B}.exe 100 PID 8 wrote to memory of 924 8 {872391C0-498C-4c7d-A10F-01D9D9A2684B}.exe 100 PID 3376 wrote to memory of 3080 3376 {1A829D01-BEA0-4238-BF08-0458346EE3F1}.exe 107 PID 3376 wrote to memory of 3080 3376 {1A829D01-BEA0-4238-BF08-0458346EE3F1}.exe 107 PID 3376 wrote to memory of 3080 3376 {1A829D01-BEA0-4238-BF08-0458346EE3F1}.exe 107 PID 3376 wrote to memory of 4292 3376 {1A829D01-BEA0-4238-BF08-0458346EE3F1}.exe 106 PID 3376 wrote to memory of 4292 3376 {1A829D01-BEA0-4238-BF08-0458346EE3F1}.exe 106 PID 3376 wrote to memory of 4292 3376 {1A829D01-BEA0-4238-BF08-0458346EE3F1}.exe 106 PID 3080 wrote to memory of 316 3080 {32FE0323-7AF7-42b8-9EE1-A63D56B72FAD}.exe 110 PID 3080 wrote to memory of 316 3080 {32FE0323-7AF7-42b8-9EE1-A63D56B72FAD}.exe 110 PID 3080 wrote to memory of 316 3080 {32FE0323-7AF7-42b8-9EE1-A63D56B72FAD}.exe 110 PID 3080 wrote to memory of 4820 3080 {32FE0323-7AF7-42b8-9EE1-A63D56B72FAD}.exe 111 PID 3080 wrote to memory of 4820 3080 {32FE0323-7AF7-42b8-9EE1-A63D56B72FAD}.exe 111 PID 3080 wrote to memory of 4820 3080 {32FE0323-7AF7-42b8-9EE1-A63D56B72FAD}.exe 111 PID 316 wrote to memory of 4584 316 {9ECFE33B-56EC-4a45-9D5E-2D3DD8D21A15}.exe 113 PID 316 wrote to memory of 4584 316 {9ECFE33B-56EC-4a45-9D5E-2D3DD8D21A15}.exe 113 PID 316 wrote to memory of 4584 316 {9ECFE33B-56EC-4a45-9D5E-2D3DD8D21A15}.exe 113 PID 316 wrote to memory of 1456 316 {9ECFE33B-56EC-4a45-9D5E-2D3DD8D21A15}.exe 112 PID 316 wrote to memory of 1456 316 {9ECFE33B-56EC-4a45-9D5E-2D3DD8D21A15}.exe 112 PID 316 wrote to memory of 1456 316 {9ECFE33B-56EC-4a45-9D5E-2D3DD8D21A15}.exe 112 PID 4584 wrote to memory of 2028 4584 {D4BCE1D1-689A-4711-8BC1-34FBAB19AD77}.exe 118 PID 4584 wrote to memory of 2028 4584 {D4BCE1D1-689A-4711-8BC1-34FBAB19AD77}.exe 118 PID 4584 wrote to memory of 2028 4584 {D4BCE1D1-689A-4711-8BC1-34FBAB19AD77}.exe 118 PID 4584 wrote to memory of 3472 4584 {D4BCE1D1-689A-4711-8BC1-34FBAB19AD77}.exe 119 PID 4584 wrote to memory of 3472 4584 {D4BCE1D1-689A-4711-8BC1-34FBAB19AD77}.exe 119 PID 4584 wrote to memory of 3472 4584 {D4BCE1D1-689A-4711-8BC1-34FBAB19AD77}.exe 119 PID 2028 wrote to memory of 3080 2028 {3898AC27-C901-4261-9818-11C4B5982E0B}.exe 121 PID 2028 wrote to memory of 3080 2028 {3898AC27-C901-4261-9818-11C4B5982E0B}.exe 121 PID 2028 wrote to memory of 3080 2028 {3898AC27-C901-4261-9818-11C4B5982E0B}.exe 121 PID 2028 wrote to memory of 4820 2028 {3898AC27-C901-4261-9818-11C4B5982E0B}.exe 122 PID 2028 wrote to memory of 4820 2028 {3898AC27-C901-4261-9818-11C4B5982E0B}.exe 122 PID 2028 wrote to memory of 4820 2028 {3898AC27-C901-4261-9818-11C4B5982E0B}.exe 122 PID 3080 wrote to memory of 1960 3080 {085DFF69-D016-40df-AC85-43979336F1B2}.exe 123 PID 3080 wrote to memory of 1960 3080 {085DFF69-D016-40df-AC85-43979336F1B2}.exe 123 PID 3080 wrote to memory of 1960 3080 {085DFF69-D016-40df-AC85-43979336F1B2}.exe 123 PID 3080 wrote to memory of 472 3080 {085DFF69-D016-40df-AC85-43979336F1B2}.exe 124 PID 3080 wrote to memory of 472 3080 {085DFF69-D016-40df-AC85-43979336F1B2}.exe 124 PID 3080 wrote to memory of 472 3080 {085DFF69-D016-40df-AC85-43979336F1B2}.exe 124 PID 1960 wrote to memory of 3400 1960 {AD042B2E-8573-4c31-9E90-27EDA5370DCB}.exe 125 PID 1960 wrote to memory of 3400 1960 {AD042B2E-8573-4c31-9E90-27EDA5370DCB}.exe 125 PID 1960 wrote to memory of 3400 1960 {AD042B2E-8573-4c31-9E90-27EDA5370DCB}.exe 125 PID 1960 wrote to memory of 2988 1960 {AD042B2E-8573-4c31-9E90-27EDA5370DCB}.exe 126 PID 1960 wrote to memory of 2988 1960 {AD042B2E-8573-4c31-9E90-27EDA5370DCB}.exe 126 PID 1960 wrote to memory of 2988 1960 {AD042B2E-8573-4c31-9E90-27EDA5370DCB}.exe 126 PID 3400 wrote to memory of 492 3400 {A03A545E-69A5-49d5-A06F-AED6EB1C271C}.exe 128 PID 3400 wrote to memory of 492 3400 {A03A545E-69A5-49d5-A06F-AED6EB1C271C}.exe 128 PID 3400 wrote to memory of 492 3400 {A03A545E-69A5-49d5-A06F-AED6EB1C271C}.exe 128 PID 3400 wrote to memory of 4352 3400 {A03A545E-69A5-49d5-A06F-AED6EB1C271C}.exe 127 PID 3400 wrote to memory of 4352 3400 {A03A545E-69A5-49d5-A06F-AED6EB1C271C}.exe 127 PID 3400 wrote to memory of 4352 3400 {A03A545E-69A5-49d5-A06F-AED6EB1C271C}.exe 127 PID 492 wrote to memory of 2304 492 {60983C17-CF91-4760-ADD7-04B5DC02C499}.exe 129 PID 492 wrote to memory of 2304 492 {60983C17-CF91-4760-ADD7-04B5DC02C499}.exe 129 PID 492 wrote to memory of 2304 492 {60983C17-CF91-4760-ADD7-04B5DC02C499}.exe 129 PID 492 wrote to memory of 1800 492 {60983C17-CF91-4760-ADD7-04B5DC02C499}.exe 130
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-01-10_4a380fbc8f12cffc01f946e7b1c07223_goldeneye.exe"C:\Users\Admin\AppData\Local\Temp\2024-01-10_4a380fbc8f12cffc01f946e7b1c07223_goldeneye.exe"1⤵
- Modifies Installed Components in the registry
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1088 -
C:\Windows\{872391C0-498C-4c7d-A10F-01D9D9A2684B}.exeC:\Windows\{872391C0-498C-4c7d-A10F-01D9D9A2684B}.exe2⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:8 -
C:\Windows\{1A829D01-BEA0-4238-BF08-0458346EE3F1}.exeC:\Windows\{1A829D01-BEA0-4238-BF08-0458346EE3F1}.exe3⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3376 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{1A829~1.EXE > nul4⤵PID:4292
-
-
C:\Windows\{32FE0323-7AF7-42b8-9EE1-A63D56B72FAD}.exeC:\Windows\{32FE0323-7AF7-42b8-9EE1-A63D56B72FAD}.exe4⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3080 -
C:\Windows\{9ECFE33B-56EC-4a45-9D5E-2D3DD8D21A15}.exeC:\Windows\{9ECFE33B-56EC-4a45-9D5E-2D3DD8D21A15}.exe5⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:316 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{9ECFE~1.EXE > nul6⤵PID:1456
-
-
C:\Windows\{D4BCE1D1-689A-4711-8BC1-34FBAB19AD77}.exeC:\Windows\{D4BCE1D1-689A-4711-8BC1-34FBAB19AD77}.exe6⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4584 -
C:\Windows\{3898AC27-C901-4261-9818-11C4B5982E0B}.exeC:\Windows\{3898AC27-C901-4261-9818-11C4B5982E0B}.exe7⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2028 -
C:\Windows\{085DFF69-D016-40df-AC85-43979336F1B2}.exeC:\Windows\{085DFF69-D016-40df-AC85-43979336F1B2}.exe8⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3080 -
C:\Windows\{AD042B2E-8573-4c31-9E90-27EDA5370DCB}.exeC:\Windows\{AD042B2E-8573-4c31-9E90-27EDA5370DCB}.exe9⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1960 -
C:\Windows\{A03A545E-69A5-49d5-A06F-AED6EB1C271C}.exeC:\Windows\{A03A545E-69A5-49d5-A06F-AED6EB1C271C}.exe10⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3400 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{A03A5~1.EXE > nul11⤵PID:4352
-
-
C:\Windows\{60983C17-CF91-4760-ADD7-04B5DC02C499}.exeC:\Windows\{60983C17-CF91-4760-ADD7-04B5DC02C499}.exe11⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:492 -
C:\Windows\{9944E714-E79B-4387-AF20-3C8F96C3F581}.exeC:\Windows\{9944E714-E79B-4387-AF20-3C8F96C3F581}.exe12⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:2304 -
C:\Windows\{E42F8875-22A6-4777-9D0B-3F85FF767880}.exeC:\Windows\{E42F8875-22A6-4777-9D0B-3F85FF767880}.exe13⤵
- Executes dropped EXE
PID:1204
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{9944E~1.EXE > nul13⤵PID:1344
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{60983~1.EXE > nul12⤵PID:1800
-
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{AD042~1.EXE > nul10⤵PID:2988
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{085DF~1.EXE > nul9⤵PID:472
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{3898A~1.EXE > nul8⤵PID:4820
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{D4BCE~1.EXE > nul7⤵PID:3472
-
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{32FE0~1.EXE > nul5⤵PID:4820
-
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{87239~1.EXE > nul3⤵PID:924
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Users\Admin\AppData\Local\Temp\2024-0~1.EXE > nul2⤵PID:4972
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
408KB
MD5f6c36ee4c2c4a3460842743cfca72543
SHA19060ee400c0dab024014bfcfabfca6ce667f7253
SHA2565d71a2abfe7ca7eec58c89a84f0181fa392073089a435c33c7d479209b82e264
SHA51212bcaafaeed2f86dfad2d1fd876ca231b799b394e20a7d778d56d030c45e3af7184fa8e7dd9d865e6021bbc9430d846f9e6c79d41289a411c1cd395547333012
-
Filesize
384KB
MD5a3c35bd707632fc11e79a8065e709bf0
SHA195337de91ba79b821c92719079c0e9c0e59431ff
SHA256b064a64890da69a6021a734a4bfb4b404404980a6c9e9d6d9a24dabdc14d5aac
SHA5129244ef56736a0209db9e6039bec00435fbaf49dfdc0c193a540bbbc096678036d5a078c76ed88adf6802efe4525b9062c76ed66982f29806d3631fd2d6568359
-
Filesize
224KB
MD51af2bc1e55df8525b60831be3a51662d
SHA1ab808a192bb9fec648c969244838f97803d760fd
SHA256aced5120cc111a2ab664d3808ad826c26b6e6c3cfadfff846a23928fa59c2c5e
SHA5124e3d58a8f922a1ecc50df8ca76e309d837edc8fb5836f865558e2ecb9c3344ef350c62aab8e9495b0f6571da943b943ab9218a5fbfcaae53dbdd242304e345a7
-
Filesize
408KB
MD58ac076917191f2906316bd163ca73dd9
SHA1e4935362bb090138de657cfcb202935cb611bb27
SHA25658c87ab4f373c2b3903503db84b42cbd9196ac61fd8063ca6388d9a207ebea66
SHA51296caddfd62ba80bbd2282f91b58ee92605718ad7c6abeaa266b77b11021faff5b28f63cf4ef3d797415077bdf4aa41bed087d415471046df5de4f56b7b8e6286
-
Filesize
408KB
MD5dff9c8cf3efd4ef2bae7dad5424d2aac
SHA1633e51cc7a91164958393c868875d906b36967b7
SHA256747c30fa0366f6c976863a9d765035740be64e564598d3a9c78a04e5f1a71d5c
SHA512fc32c9db356e25eb7efbae06a17163d9be33ee6c27d7c4b6dcb07dae13809aac66b483f99249226489cee230e6bc8cf2caa494712811b9b8fe533a33f626d3d2
-
Filesize
408KB
MD5ea28e359fc9457646fc346266cf02c9f
SHA16f3fb777907fe5e115058af1722c6c3abf7b3384
SHA256856bc617e4411a4aaa58cee7b8a0b4d231288b05389c1c2759affaa652ae967d
SHA51226720916fa8528d953b6543926a5de634965eb3673a795a4ecc5b3fb7bcd0bd28eab3c60d6dc398104e13ec6f2a0bf8f0e9d1303d124abe4f211006e564b3350
-
Filesize
408KB
MD5153dbf8566ee38ff190b074aa839e446
SHA19a834765c82b6ef1b32875f33b8a7587467e95e2
SHA256300e4cfd33e3444735c899fc3b70537cbfd16adc9eb6b4c9c318daca5b5a7e60
SHA5123137ec0910f7204782dcb924460aa84cc6fc980d1ab05addec022a7611a2d13cea12d2d63d70f3aa108f84d496df4ba2a5cf628a402150bbb3ea3afe96dd4e18
-
Filesize
408KB
MD56848d412043ff5dc23204b7f63ed4369
SHA1328fdd910cda08038a550ae0234baf12c7343563
SHA2565cb693fbea14265286798d331336ce18a8d7fc5f70cebc4f2f4f3fa2cf1f6562
SHA512aeb0c6096a9b354335ee71f06ed900dc49799a6b798e6fa09430f80bf095f543689396769d70a6dffd8f2e6009e19a0230fc74c426ffceb961230ca76e739f58
-
Filesize
408KB
MD5037e97ac8fc9571c20254cefd495be5f
SHA1274dffa16e2e6bf52af27cb2729b5bd26774e169
SHA2561f6bbf7b5a3a923173bd61cd663b349f87d02afdb220fc20960bdbf21dd2e4d0
SHA512deb5d904cfe2b7254b1a75b9fb62113ae9e4ff4edc5d682adc0b08a792fd574ef1fb829e9356b74abd9cc8c8f19d76b9bfac9598a590f48345673035577f4552
-
Filesize
408KB
MD5b28515cbd9e75c70ea39f77fb88b1521
SHA14563a6ae2af9b1094fe4925d4aea27837dfb0259
SHA256aa3b73b23885c4cd3118f48b676c8c9057e47686ad062f3f644a29f3ac5b1d92
SHA512231be6169b7fba999983d7979054d5ca4b9f5a370d4a2c94f80366eb5031cdd3db37afa60c3e64d7586faed3430bbf977f91025a0ad0763e67768c777a3ff87d
-
Filesize
408KB
MD570aa338743343f9617acaf0101dde594
SHA14fabff0bdc619ee62ba486352cf7733aba8b934a
SHA256a9ddb01db5354e90feb4552bed17c1a2e5cecdb3cd8077a790004735a0d688fc
SHA512673b421973585ede2671803e2b2dce3432aa28620e72e65f6946e2d1e1101b54ec877b5651ce0a36c2634f06ee2733a0203ee88db31ef84c99c6781132c9b35c
-
Filesize
408KB
MD5573a6798dc58dbed4d803c5c76973037
SHA15bcba2b90fcd1cb3c7bc4d49b9725aaf494c2fed
SHA2561baae8241cf41208a993b1e0591c5c6c1225f36621b1a23b017477d1904466ef
SHA5122a8bb5dce7c646d93d95b328523e25652d5eac2cf452e212217ccf3b35bf38d10f4f7ce1e25239b54ff5f20215efb30de5c07a926ad34c40e0c4b51343722bdb
-
Filesize
408KB
MD59bc308716ec137714e43cbab4a1ce666
SHA131812f5cd0e571fceae74a2d3eba6cb93211c4d6
SHA25615e415a1b9f0f8b14518b29d9fc7b49b7985c872114d66263dfe9fb4ad15d0fb
SHA5124f6c86db33e59289a7996158f52e5265987a10eb9a0f9273aca6c5796f23538abc25a6b63555c6892bdfaa7ece904fbd1e11f5150a98b8f86153b2f7b6d674d9